OFAC issued 14 public enforcement actions in 2025[SI1] . The largest single penalty was a civil fine of just over $215 million against a California venture capital firm for continuing to manage a US investment linked to a sanctioned individual and, separately, for failing to comply with an OFAC subpoena. Other 2025 actions touched a logistics company, a manufacturing business, a real estate firm, an electronics manufacturer, a brokerage, and a petrochemicals business. The industries represented in OFAC’s 2025 enforcement record are not the ones that have historically maintained sophisticated sanctions compliance programmes. They are the ones that assumed the programme did not apply to them.
An administrative subpoena from the Office of Foreign Assets Control (OFAC), the United States Treasury body responsible for administering and enforcing economic and trade sanctions programmes is not, in itself, an accusation of wrongdoing. It is a formal request for documents, records, and information. It is also one of the most consequential pieces of correspondence a business can receive, because of what its arrival signals and what the response to it determines.
The enforcement framework operates on strict civil liability. OFAC does not need to establish that a business intended to violate sanctions, or that it knew it was doing so. The legal test is whether a prohibited transaction occurred. Intent and knowledge are relevant to the calculation of penalties, but they do not determine whether a violation has taken place. Criminal exposure through the Department of Justice can arise independently and in parallel, without OFAC having made any referral.
For businesses outside the United States, the reach of the sanctions framework is frequently underestimated. OFAC’s authority extends to any transaction that passes through the US financial system, involves US persons, or touches US-jurisdiction entities a scope that in practice covers most international commercial activity conducted in US dollars, regardless of where the parties are located.
When an OFAC subpoena arrives, it typically requests several categories of information: transaction records covering the specific activity under review; counterparty information including ownership structures and ultimate beneficial ownership; internal communications showing what people within the business knew, what questions were raised, and how decisions were made; and compliance materials including sanctions screening policies, training records, and audit results. The document production timeline is usually tight, often 30 days and the manner in which the business responds carries as much legal significance as the underlying facts. A business that responds promptly, cooperates fully, and demonstrates a functioning compliance programme is in a materially different position from one that responds slowly, produces incomplete records, or cannot show that sanctions screening was integrated into its operations.
The 2025 penalty against the California venture capital firm is instructive specifically because part of the penalty related to the subpoena itself not only to the underlying conduct. Failing to comply with an OFAC subpoena is an independent violation, separate from whatever prompted the subpoena in the first place. A business that receives a subpoena, underestimates its significance, and produces an inadequate response has compounded its legal exposure before the underlying question has even been resolved.
Sanctions compliance has historically been understood as a concern for banks, financial institutions, and businesses with obvious exposure to restricted jurisdictions or sanctioned parties. The 2024 and 2025 enforcement record challenges that assumption directly. A logistics company, a real estate firm, a venture capital fund, and a manufacturing business all appeared in OFAC’s enforcement actions within the past two years. The common thread is not industry, it is a gap between the scope of OFAC’s authority and the compliance programmes businesses had built around a narrower understanding of who it applied to.
For any business operating across multiple jurisdictions particularly those with US dollar-denominated transactions, US banking relationships, or clients and counterparties in markets with sanctions exposure the question worth asking is whether the compliance programme currently in place is calibrated to where the enforcement priorities are.
